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We show a potential eavesdropper can eavesdrop whole secret information when 

o . 

CN . the legitimate users use secure carrier to encode and decode classical information 

C$ , repeatedly in the protocol [proposed in Bagherinezhad S and Karimipour V 2003 



Phys. Rev. A 67 044302]. Then we present a revised quantum secret sharing 
protocol by using Greenberger-Horne-Zeilinger state as secure carrier. Our protocol 
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Quantum secret sharing (QSS) is a generalization of classical secret sharing to a quan- 
tum scenario. The basic idea of QSS is: After Alice distributes her secret message to the 
receivers (Bob, Charlie, . . .), all the receivers can obtain the secret message simultaneously 



by collaboration. Since Hillery et al. 1] proposed the 
tracted a widespread attention and progressed quickly 



Dioneering QSS work, QSS has at- 



over the past 



> 
X 

several years. In 2001, Guo et al. [lfj proposed a quantum key distribution protocol by 
using quantum key to encode and decode classical information. The quantum key can be 
used repeatedly. Based on Guo's protocol, Karimipour et al. proposed a QSS protocol 
by using Greenberger-Horne-Zeilinger (GHZ) states as secure carriers. 



Recently, Gao et al. 



121 ] present an eavesdropping 



protocol by which Eve can obtain 



llj . Karimipour shows that the 



odd numbered data bits of Karimipour's protocol 
quantum bits in odd rounds can be discarded by legitimate users. Only if Eve can get the 
whole information, this protocol can be proved insecure. In this paper, we propose another 



eavesdropping method to the protocol in Ref. 



□ 



. Eve can get the whole information 
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without being detected by the legitimate users. Then we present a revised QSS protocol 
by using GHZ state to encode and decode classical information. Our QSS protocol can be 
robust against Eve's attack. 

First of all, let us give a brief review of Karimipour's protocol 11]. In the beginning, Alice, 
Bob and Charlie have shared a GHZ state \ip) = ^(|0,0,0) + |1, 1, l)) a ,6,c as carrier (used 
subscripts a, b and c on the states and operators for Alice, Bob and Charlie, respectively), 
and the data bits Alice wants to distributed to Bob and Charlie can be represented by 
91)93)95)" (where q = or 1) in odd round and 92,94,96>""" (where q — > q = |g) 12 = 
-^{\0,q) + |1, q © 1)} and "©" is performed modulo 2) in even round. In odd round, Alice 
entangles the state \q, q)\ } 2 to the carrier by performing controlled-NOT (CNOT) operations 
C a i, C a2 and send them to Bob and Charlie (C a i is the controlled-NOT gate and is specified 
by two subscripts, the first one is the control bit, the second one is the target bit). Bob and 
Charlie act on this state by the operations C&i, C c i to read independently his own bit. In 
even round, Alice performs C a \ to entangle the state \q)i2 to the carrier. Bob and Charlie 
disentangle the state \q)u from the carrier by the operations C&i, Bob and Charlie can 
gain Alice's information by collaboration. Now let us describe our eavesdropping strategy 
to eavesdrop the whole information of Eve prepares two qubits (ei and e 2 ) in state |0) 
as her two ancilla. 



^1) In the first round, according to the method in Ref. [12|, Eve intercepts the first 
sending qubit which is denoted by subscript 1, and then performs a controlled-NOT (CNOT) 
operation C\ ei on this qubit and her ancilla after Alice sent the particles. This state of these 
qubits can be specified by 

' ^(|0, 0, 0, 0, 0, 0) + |1, 1, 1, 1, 1, l» aAc , ei ,i, 2 { qi = 0), 

l^ 1 ) = (1) 

^(|0, 0, 0, 1, 1, 1) + |1, 1, 1, 0, 0, 0)) Oj6jC)ei)li2 {qi = 1), 
and then Eve resends it to Bob. Here superscript 1 denotes the first round. The value of q n 
denotes Alice's sending information. Bob and Charlie can get the right information when 
they disentangle the sending qubit from the carrier. 

(2) In the second round, as Alice, Bob and Charlie perform a Hadamard gate on their 
particles, respectively, Eve also performs the same operation on his ancilla e\. After Alice 
entangles the entangled state to the carrier, she sends the two particles (1 and 2) to Bob 
and Charlie, then Eve intercepts the two sent qubits and performs two CNOT operations 
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Cie 2 , C 2e2 - The qubit e 2 is also entangled to the carrier. Eve performs a CNOT operation 
C ei i. She resends them to Bob and Charlie. After Bob and Charlie performed two CNOT 
operations Cbi, C c2 to disentangle their receiving particles from the carrier and measured 
the qubits 1 and 2, they cooperate to get the value of q 2 and can't detect the presence of 
Eve, while leaving the state 

^-(|0,0,0,0,0> + 10,0,1,1,0) + 10,1,0,1,0) + 10,1,1,0,0) + |1,0,0,1,1) 

+ |1, 0, 1, 0, 1) + |1, 1, 0, 0, 1) + |1, 1, 1, 1, l))„,6,c,e 1 ,e a (92 = 0, <?! = 0), 

^(|0, 0, 0, 0, 1) + |0, 0, 1, 1, 1) + |0, 1, 0, 1, 1) + |0, 1, 1, 0, 1) + |1, 0, 0, 1, 0) 



+ |1,0,1,0,0) + 11,1,0,0,0) + |l,l,l,l,0)) oAc , ei;e2 (q 2 = l,9l = 0), 



(2) 



^(|0,0,0,0,0) -10,0,1,1,0) -10,1,0,1,0) + 10,1,1,0,0) -|1,0,0,1,1) 

+ |l,0,l,0,l) + |l,l,0,0,l)-|l,l,l,l,l)) oAc , ei ,e 2 (92 = 0,^1 = 1), 

^(|0, 0, 0, 0, 1) - |0, 0, 1, 1, 1) - |0, 1, 0, 1, 1) + |0, 1, 1, 0, 1) - |1, 0, 0, 1, 0) 

+ |l,0,l,0,0) + |l,l,0,0,0)-|l,l,l,l,0)) aAc , ei , e2 (q 2 = 1,91 = 1). 
(3) In the third round, Eve can eavesdrop the odd round's key bit. Firstly, Eve also 
performs a Hadamard gate on each of her two ancilla, when Alice, Bob and Charlie perform 
a Hadamard gate on their respective particles. The state of Alice, Bob, Charlie and Eve can 
be expressed as 

£(|0,0,0,0,0) + 11,1,1,1,0) + 11,0,0,0,1) + |0,l,l,l,l)) oAc , ei , e2 (?i =0,q 2 = 0), 



i(|0, 0, 0, 0, 0) + |1, 1, 1, 1, 0) - |1, 0, 0, 0, 1) - |0, 1, 1, 1, l)) a ,6, c , ei ,e 2 (91 = 0, q 2 = 1), 



|(|1,1,1,0,0) + 10,0,0,1,0) + 10,1,1,0,1) + |l,0,0,l,l)) oAc , ei , e2 ( Ql = l,q 2 = 0), 



i(|l, 1,1,0,0) + |0,0,0, 1,0) - 10,1,1,0,1) - |l,0,0,l,l))„,6,c,e 1 ,e a (qi = 1,92 = 1), 



(3) 
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After Alice sent out the two qubits, Eve intercepts the two qubits and performs four CNOT 
operations C ei i, C e2 i and C ei2 , C e22 . Eve makes a measurement on one of two qubits (1 
and 2) and gets the value of q$ © q%. After Eve performs C ei i and C ei 2, she resends the 
two qubits (1 and 2) to Bob and Charlie. Bob and Charlie perform C&i and C c2 on their 
respective qubits. We conclude that Bob and Charlie get correct result. 

(4) In the fourth round, Alice, Bob, Charlie and Eve perform a Hadamard gate operation 
on their respective qubits. As a result, the state of whole system will be converted into 
Eq. (j2J). In this round, Eve can eavesdrop the key bit of even round without being detected. 
Suppose information bit of Alice is = \k)i 2 (k = or 1), after Alice performed a CNOT 
operation C a i and sent the two qubits to Bob and Charlie, Eve intercepts the two qubits 
and performs a CNOT operation C e2 \. The two qubits have disentangled from the carrier. 
Eve can perform two single particle measurements on the two qubits (1 and 2) and get the 
value of q 2 © q<i- Afterward, she prepares two qubits in the state \q 2 © qi)v,2' and performs 
CNOT operations C e2 i/, C ei i> and sends them to Bob and Charlie, respectively. Bob and 
Charlie act on their respective qubits by the operations Cbv and C C 2>, so they can get the 
correct information. 

(5) In next odd and even rounds, Eve uses the same strategy in step (3) and (4). So Eve 
can get the information ( q\ © q 3 , q± © q$, • • ■ and q 2 © q&, q 2 © qe, ■ ■ •)• As l° n g as any odd and 
even numbered data bits are announced by Alice, Eve could obtain Alice's full information. 

Comparing with Gao's strategy Q our strategy improves the efficiency of eavesdropping. 
We can prove that the protocol is insecure by our eavesdropping strategy. So we modify 
this protocol as follows: 

(1) Alice, Bob and Charlie have shared one three-particle state \x) as carrier (the state 
can be expressed as \x) = 0> 0) -h 1 1 , 1, l)) ,6,c )• The following property will be used: 

H ® H ® H\ X ) = \G) = i(|0, 0, 0) + |1, 1, 0) + |1, 0, 1) + |0, 1, l)) aAc . (4) 

(2) Before Alice sends her information qubits to Bob and Charlie, she decides if she 
performs a Hadamard gate on her qubit a. If Alice performs a Hadamard gate on her qubit, 
she chooses two qubits which are in two-qubit state q — > q = \q)n = 775 (|0? q) + © 1)) 
for sending a classical bit. Alice performs one single CNOT gate C a \ to entangle this state 
to the carrier 

IV>> = + 11,901)) ® |0,0) + (|0,g) - \l,qWT)) © |1, l>} a ,a )2 ,6 t c, (5) 
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and sends the two qubits to Bob and Charlie. After Bob and Charlie have received the two 
qubits, Alice informs that she did a Hadamard gate. Then Bob and Charlie also perform a 
hadamard gate accordingly. This state of these qubits will be specified by 

M = ® (|o,o) + |i, l)) + |i,?TT) ® (|o, l) + |i,o))} a , li2Ac . (6) 

Bob and Charlie perform two CNOT operations C&i and C c2 on their respective qubits to 
disentangle qubits 1 and 2. 

(2') If Alice does't perform a Hardamard gate on his qubit a, she will choose two single 
particles which are in the state \qi) and \q 2 ) (<?i, q 2 £ (0,1))- The classical bit is the value of 
qi © q 2 . Alice performs one CNOT gate C a i or C a2 to entangle one of the two particles to 
the carrier. Suppose Alice performs C a \- The state of these qubits can be expressed as 

W) = -^{d°> 0, 0, gi ) + |1, 1, 1, gi © 1)) © \q 2 )}a,b,ci,2- (7) 

Alice sends the two qubits to Bob and Charlie. After Bob and Charlie have received the two 
qubits, Alice informs that she did not perform a Hadamard gate and performed a CNOT 
gate C a \. Then Bob perform C&i to disentangle his receiving qubit 1. 

(3) Bob and Charlie performs single particle measurement on their respective particles 
(1 and 2). Only one of them publicly announces the measurement result, and the other will 
add the publicly announced result to his own measurement result to get Alice's information. 

(4) In next round, Alice know the three-particle state is in \x) or \G) according to the 
number of Hadamard gate she has performed. Alice, Bob and Charlie do similar operations 
from step (2) to (4). 

(5) At last, Alice publicly announces part of classical bits through a classical channel. 
They compare the results and analyze the error rate. If the error rate is reasonably low, 
they can believe the security of the process. Otherwise they terminate the QSS and start 
next one form step (1). 

Now, let us discuss the security of the revised protocol. For convenience, we call Gao's 
attack strategy in Al, and call our attacking strategy A2. Suppose Eve intends to 
use Al to attack. Eve intercepts one of the two qubits 1 after Alice sent the qubits. Eve 
prepares a qubit in the state |0) as her ancilla e. She performs a CNOT operation C\ e . Eve 
doesn't know that the qubits sent by Alice were in single particle state or two-qubit state. 
If the qubits sent by Alice are in two-qubit state (i.e., |0) ), the state of whole system will 
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be converted into 

|^) = i{|0>® (|0, 0,0) + |1, 1,1)) (g) |0,0) + |1) 0,1) + |0,1,0)) ®|l,l)}„,i, 2 , eAc ,. (8) 

After Bob and Charlie received Alice's sending qubits, Alice announces that she performed 
a Hadamard gate. Bob and Charlie also perform a Hadamard gate on the qubits b and c. 
Then they perform a CNOT operation C&i and C C 2 and make a single particle measurement 
on their qubits (1 and 2), respectively. The state of these qubits will be converted into one 
of the two states: 

' ±(|0, 0, 0, 0) + |0, 1, 1, 1) + |1, 0, 1, 0) + |1, 1, 0, l)) aAc , e , 
|V) = (9) 
|(|0,0,0,l) + |0,l,l,0) + |l,0,l,l) + |l,l,0,0)) aACie . 

In next round, when Alice sends single particles as information qubits to Bob and Charlie, 
the eavesdropping behavior makes error in comparing the data bits jointly received by Bob 
and Charlie with those sent by Alice. If Alice sends single particles as information qubits in 
the beginning, Eve performs a CNOT operation C\ e on the intercepted qubit and her ancilla. 
Eve might entangle his ancilla to the carrier. But in next round Alice doesn't announce if she 
has performed a hadamard gate until Bob and Charlie received her sending qubits. Owing 
to Eve doesn't know how to operate the intercepted qubit, she inevitably introduces error. 
So Eve can't get any useful information and her eavesdropping behavior will be detected by 
the legitimate users. 

Suppose Eve wants to entangle his ancilla to the carrier by using the method of even 
round in A2 to attack. After Alice sent his two information bits to Bob and Charlie, Eve 
intercepts the two sending qubits and performs two CNOT operations Ci e , C^ e on the two 
particles and her ancilla. Eve's aim is to entangle the state of his ancilla to the state \G). 
When Alice sends single particles as information qubits and performs a CNOT gate C a i, the 
state of whole system can be expressed as 

\4>) = ^f{(l°> °> °> 9i. ^ © 92) + |1, 1, 1, Qi 1, qi q 2 8 1)) ® |g 2 )}a,6, C) i,e,2. (10) 

When the two qubits sent by Alice are in two-qubit state, Eve can also entangle her ancilla 
to the carrier. Then the state of these qubits can be as follows 

W) = i{(|0,0,0,Q, g> + (|l,l,0,^eBT,gel> + (|l,0,l,^eBT,g©l> + (]0,l,l,g, g>)} aAc ,i, 2 ,e- 

(11) 
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When Alice sends his information qubits in next round, Eve can not know these information 
qubits of Alice are in single particle state or two qubit-state ahead of time. So Eve should 
not decide how to operate and eavesdrop information. 

Even if one of the legitimate users (Bob) is dishonest and wants to eavesdrop Alice's 
information by intercept-and-resend attack strategy, he can't also eavesdrop the information 
without being detected. For example, after Alice sent two information qubits, Bob intercepts 
the two qubits and sends his qubit 2' to charlie. Charlie would take the qubit 2' for Alice's 
qubit 2. If Alice sends two single particles as information qubits and entangles Bob's qubit 1 
to the carrier, she announces her operations after confirming Bob and Charlie have received 
their qubits. Then Bob can perform a CNOT gate C&i and two single particle measurements 
on the qubits 1 and 2. So he can get the value of qi © q%. Bob also knows the value of qy, 
and then he can announce the value of qy according to q\ © q 2 = qv © qy ■ As a result Bob 
can get the secret information without being detected. But when Alice entangles Charlie's 
qubit 2 to the carrier, Charlie should perform a CNOT gate C C 2' and make a measurement 
on her receiving qubit 2'. She will get the value of q^ or qy © 1. Bob can still gain the value 
of q\ © q2 after knowing Alice's operations. But he can't know the measurement result of 
Charlie is qy or q 2 > © 1. This would lead to 50% difference between the bit recovered by 
Charlie and the information bit Alice has sent. If Bob intercepts the two qubits which are in 
two-qubit state, he can't get the right information according to Eq (£Q). His eavesdropping 
behavior will be detected by the legitimate users. 

In summary, firstly, in our revised QSS protocol the secure carrier can be used repeatedly 
to send secret information when there is no presence of Eve. Secondly, Eve can't eavesdrop 
the secret information by entangling her ancilla to the carrier. The dishonest one of the 
two legitimate users can't gain information without bein g d etected. The revised protocol is 
unconditionally secure. Thirdly, in the original protocol [11] Alice encodes information bits 
as a state \q, q) for sending odd bit. Bob and Charlie can recover the information bit without 
each other's assistance. In our protocol, Bob and Charlie must cooperate to gain Alice's 
information in every round. So our protocol improves the efficiency of the secret sharing. 
Furthermore, when Alice sends N bits information to Bob and Charlie, they will perform iV 
Hadamard gates in the original protocol. In our protocol they will perform Hadamard gate 



8 

operation randomly. Our protocol decreases the number of Hadamard gate operations. 
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